Slashdot Mirror
NSA Official: Supporting Backdoored Random Number Generator Was "Regrettable"
Trailrunner7 writes In a new article in an academic math journal, the NSA's director of research says that the agency's decision not to withdraw its support of the Dual EC_DRBG random number generator after security researchers found weaknesses in it and questioned its provenance was a "regrettable" choice. Michael Wertheimer, the director of researcher at the National Security Agency, wrote in a short piece in Notices, a publication of the American Mathematical Society, that even during the standards development process for Dual EC many years ago, members of the working group focused on the algorithm raised concerns that it could have a backdoor in it. The algorithm was developed in part by the NSA and cryptographers were suspect of it from the beginning. "With hindsight, NSA should have ceased supporting the dual EC_DRBG algorithm immediately after security researchers discovered the potential for a trapdoor. In truth, I can think of no better way to describe our failure to drop support for the Dual_EC_DRBG algorithm as anything other than regrettable," Wertheimer wrote in a piece in Notices' February issue.
Is he sorry that they created a monster or is he just sorry that they got caught and now their credibility is in the trash can?
"describe our failure to drop support for the Dual_EC_DRBG algorithm" = as designed
...that they got caught, he means.
To ensure it's inclusion as default in RSA products.
criminal? fraudulent? subversive?
People in cars cause accidents....accidents in cars cause people
They're sorry they got caught, and only that because of how much harder it will make pulling the same thing again in the future.
since noone cared, what is a blackout in DC to a rumoured TERRORIST act?
I'd like to hear him explain his regret in a little more detail. Was it morally wrong? Was it against civil ethics? Was it anti-democratic? Was it illegal? Or was it that they got caught?
Also, "is regrettable" is basically the passive tense. Does he regret it? Does he thing that the congressional oversight committees are morally culpable for not having stopped it?
Parse his words carefully. He never admits that the NSA actually engineered the backdoor into the algorithm, he only states that he regrets supporting the algorithm after other people pointed out it was backdoored.
This is basically equivalent to the mealy-mouthed apologies you hear from young children after they've done something wrong but absolutely refuse to fess up about it.
He said:
NSA should have ceased supporting the dual EC_DRBG algorithm immediately after security researchers discovered the potential for a trapdoor.
I find it very interesting the wording. They think that they should have "ceased supporting the dual EC_DRBG algorithm immediately after security researchers discovered the potential for a trapdoor" and that their failure to do so was regrettable. What about their helping to develop the algo with a back door to begin with?
They are essentially coming out and admitting they are sorry that they didn't drop support, because if they had dropped support at least they would have been able to cover up the fact they intentionally create algorithms with flaws to begin with.
Criminals who get caught see their actions as regrettable. Criminals who don't get caught have no regrets.
Nothing happened. The spying continues as if nobody said a thing. It had no effect on the election, and it won't have any effect in the next one. Whatever the NSA does from here on out cannot be blamed on anybody but the voters. It's extremely simple.
“He’s not deformed, he’s just drunk!”
With hindsight, NSA should have ceased supporting the dual EC_DRBG algorithm immediately after security researchers discovered the potential for a trapdoor
So really he regrets they got caught trying to insert a backdoor and wishes they would have handled the after math of being busting in a way that might have won back some undeserved trust, but he does not regret attempting back door the algorithm in the first. I read this as "would do it again".
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
More like "the fact that we got caught providing the cleverly backdoored code is regrettable."
...after they were called on it. So much for veracity.
That's no apology, it's that's just expressing regret.
If they really wanted to apologize, they should be apologizing for subverting the standards process in the first place. Both RSA's and NIST's credibility are in the crapper thanks to them, though it's admittedly RSA's own fault for taking the $10 million.
But there's no point in apologizing to the crypto community or even to any subset of it. This behavior by the NSA was almost expected, and it would be stupid to not believe it given all the pre-Snowden evidence. In fact, it validates a lot of people's conclusion that funny-looking and funny-smelling things should generally be avoided.
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
It was "regrettable" that, after the whole community cast aspersions at your intentionally-broken algorithm, you didn't drop your own support for it? Go eat a fucking dick.
What you should have done, instead of "dropping your support", was come clean and say "sorry guys, that was a shitty thing to do and we should not have done it. This algorithm was in fact sabotaged by us and it should never be used for anything other than a case study for cryptographers learning to detect shitty things like this being done to algorithms in plain sight. We ought to using better tools to catch bad guys rather than intentionally breaking encryption for everyone."
Asshole. Dual-use technologies work both ways, smarty-pants: if you break the algorithm, it's broken for the good guys, too, and the bad guys pwn everyone who thinks they are safe.
Seriously, fuck you.
"I can think of no better way to describe our failure to drop support for the Dual_EC_DRBG algorithm as anything other than regrettable." Allow me to help: indecent, dangerous, immoral, short sighted, borderline criminal.
I find Werthiemer's characterization of this gross oversight to be..."regrettable."
Let's remind the reader and put the role of NSA mathematicians in context: In the world of mathematical research, what the NSA knows is by construction a superset of what the academic community knows. That is to say, NSA researchers have at their disposal the body of all published mathematical literature, in addition to any discoveries they have made internally, whereas non-NSA mathematicians do not have access to the latter. If a flaw in a commonly used cryptographic scheme is discovered by the NSA but is unknown in the public arena, this immediately leads to an exploitable situation.
Thus, when outside researchers discover an issue, this tells us NOTHING about if or when the NSA knew about the same flaw. It also means nothing for NSA mathematicians to apologize or write in public correspondence what their version of events was. Their lack of credibility does not stem from the existence of such flaws; no. Neither does it necessarily follow from the lies they have told in other respects. On this point I must be completely clear. Their lack of credibility stems from the aforementioned and inherent information asymmetry. To attempt to infer the sincerity of the message based on indirect evidence, past behavior, and allusions to glorious historical efforts is to be misled from the fundamental reality, which is that the NSA and its mathematicians are under no obligation to tell the truth because they undoubtedly possess mathematical secrets that the public does not.
That said, I am gratified that many preeminent mathematicians working in the fields of number theory, cryptography, algebra, combinatorial analysis, and cryptanalysis do not choose to work for the NSA and instead remain in the academic community, on the premise that the advancement of humankind necessitates the openness of the process of discovery and the unrestricted dissemination of mathematical research.
Michael Wertheimer, the director of researcher at the National Security Agency, was found in his garage dead this morning. Medical officials say he died from auto-erotic asphyxiation. He left a suicide note saying he was "sorry for ever speaking out against my excellent employer and even death cannot undo what I have done".
Why not use a real random number generator (such as avalanche noise in a semiconductor junction) to generate a key instead of a pseudorandom number generated by software that can be back-doored?
Who exactly are they speaking to when they try to come out all apologetic about their recent behavior ? In what universe do they think that any amount of PR or damage control at this point will restore trust in the ( or any secret ) agency ?
Because of their bullshit, NO ONE ( foreign or domestic ) trusts any part of the American Government now. There is absolutely nothing they can say ( even IF it is the absolute truth ) that will be believed. Not by Americans, and certainly not by the rest of the planet. Their bullshit antics are ->- close to destroying the American technology sector if they haven't already.
Seriously. Would YOU buy any technology based gear at this point from an American company and not wonder if the damn thing was compromised before you even unboxed it ? Would you transmit sensitive data of any kind across the Internet knowing it's going to find its way into the American Governments hands ? Hell you can't even trust the damned crypto because the idiots are actively sabotaging it. That's just fucking brilliant.
Do you understand what happens next when no one feels safe from their government ?
If not, here's a tip.
If the laws of this land are insufficient to curb what is not only blatant but arrogantly illegal behavior, perhaps we should cease relying on the laws and remind ourselves of the reasons for one of our more controversial amendments.
Revealing methods and techniques whether by direct or indirect actions is an act of Treason and punishable by death.
I question the validity of the article and sources.
"It's something We should feel ashamed about. We DON'T feel ashamed, though." Big big difference.
This is an organisation with not a shred of credibility. Their interference of the United States in the affairs of my own country is malignant. I have nothing but contempt for the US regime, and all of the totalitarian apparatus of state that surrounds it. Poor Americans, living in such a dreadful, and totally authoritarian regime.
NSA Official: Supporting Backdoored Random Number Generator Was "Regrettable"
He then steepled his fingers and muttered "mwuhaha" under his breath.
Isn't "regrettable" how Bond villains usually refer to their gruesome murders of formerly trusted employees?
systemd is Roko's Basilisk.
Little more than just suspecting if so
Yep, sorry they got caught.
He wishes the NSA had not done something dumb that they did.
That's nice, but what process is he setting up inside the agency to prevent this from happening again?
The correct answer is to get off the 'we need to see everything' addiction and support the ability of folks to have privacy.
The likely answer is the junkie's answer of just getting better at not getting caught.
There is an old story about folks who live in glass houses.
Any new NSA internal process should be about making stronger glass.
The NSA's desire to make weaker glass for the bad guys ignores that it also makes our glass weaker.
This makes sense if only the NSA can throw rocks.
But anybody can throw rocks.
Unfortunately, it seems our security and information economy depend more and more on this stuff working.
He does a good job of calling out pretty much everything expressed here. As well as highlighting some of the half-truthes and/or complete lies in the letter.
What was wrong with their random generator...
Yeah, it's regrettable that in pursuit of spying on your own citizens and other departments of your own govrrnment, you dropped all of our collective pants to a long list of potential attackers. On second thought, maybe I'm overstating things. How many people who want to damage American interests can afford a room full of GPUs and some math Phds? It's all good. Let's just move along.
Every rule has more than one consequence.